LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65018.json"
}[
{
"digest": {
"line_hashes": [
"166375070723291529406421301066248769034",
"275647010778297936193963675511576832388",
"256826767335212246520616614652191899280",
"279336807821086835335477021495116274772",
"289998086382119027680343151146219735692",
"127562272222925286109814353033687270978",
"25813353444574047506367402039418644046",
"253582453789718568595455958296774742498"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-1ff2fa39",
"target": {
"file": "png.h"
},
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86"
},
{
"digest": {
"line_hashes": [
"156580915294223224015440899088615326697",
"218405736567565762721805663647781263162",
"85662020663482796805838288188511316315",
"230686006833406113235008350425423979914",
"260919417129355689179955630465652050316",
"95506800799202743812829450076592490423"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-485b33da",
"target": {
"file": "png.c"
},
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86"
},
{
"digest": {
"function_hash": "308839484675692000161271595223156832928",
"length": 481.0
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-a8777218",
"target": {
"file": "png.c",
"function": "png_get_copyright"
},
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86"
},
{
"digest": {
"line_hashes": [
"52540900908244694562855646578057113774",
"200219053898519147474761570586990540810",
"23871324486584156747326023564743243101",
"63048311541359152088830007041723625585"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-e1a15be6",
"target": {
"file": "pngtest.c"
},
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86"
}
]
[
{
"digest": {
"line_hashes": [
"301538088964340392606706499638159721560",
"219698033185987930519472075599950372348",
"118861229656205118168890257752076913306"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-c57bf1c7",
"target": {
"file": "pngread.c"
},
"source": "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d"
},
{
"digest": {
"function_hash": "20229053456542728879289813519749771341",
"length": 1600.0
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-65018-e67b5639",
"target": {
"file": "pngread.c",
"function": "png_image_finish_read"
},
"source": "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d"
}
]